Privacy Policy

indiebrotherhood Privacy Policy
Effective: October 25, 2026 · Version 2026-10-25-privacy-v8

This policy explains how indiebrotherhood handles information. Contact: founder@indiebrotherhood.com.

1. Information we handle
We handle account information (email, unique artist name, authentication identifiers, verification status, and profile choices); an age declaration and the resulting minor/adult eligibility status; content you choose to upload or enter; feature activity, XP, streaks, badges, Coin balances and transactions; optional 1–5 experience and return-likelihood ratings; purchase and subscription records; support messages; and security/technical data such as request time, device/browser information, IP-derived security signals, and error logs.

2. Age data
During signup, the server uses the entered birth date to determine whether the account is under 13, a 13–17 minor, or an adult. The exact birth date is not retained by indiebrotherhood after that calculation. We retain the derived age band, guardian-approval status, applicable policy versions, and declaration/approval times. For a teen account we encrypt the guardian email used to send a single-use approval link. Users without a sufficient adult declaration cannot access Hang Out, DMs, cyphers, battles, or Lyric Pro explicit mode.

3. How we use information
We use information to authenticate users; provide, personalize, secure, meter, and improve tools; maintain profiles and progress; process purchases; prevent fraud and abuse; moderate community features; respond to support; comply with law; and communicate important service changes. Firebase keeps the account signed in on the user's browser until the user signs out, clears that browser's site data, or the session is revoked or expires. Users should sign out on shared devices.

4. Processing and providers
Google Firebase/Firestore and Cloud Run support authentication, application hosting, databases, and logs. Google reCAPTCHA Enterprise assesses entrance-check interactions for automated-abuse risk. The service stores a signed first-party return cookie and short-lived pseudonymous security records; raw IP addresses are not displayed in the founder dashboard and risk signals do not automatically ban or deny visitors. Resend processes guardian-consent and in-app support emails; verified in-app feedback includes the member's account email so the founder can reply. Stripe processes payments. Google AI services may process prompts, selected content, and necessary context when a user invokes a cloud-AI feature. A feature described as browser-local processes its core media in the browser, but ordinary hosting, authentication, security, and telemetry requests can still occur. Optional AI actions may send selected extracted text or content to the named provider.
On the public landing page only, visitors may separately allow Contentsquare visitor-behavior analytics. The tag is not loaded before that choice, session replay is excluded, and it is opted out when the visitor opens sign-in or leaves the public landing page. We send a root path without URL query parameters; Contentsquare may still receive technical data such as IP address, browser details, and first-party analytics cookies. Declining does not limit use of the site. The visitor can change this choice using Visitor analytics settings on the landing page.

5. Sharing
We do not sell personal information. We share information only with service providers acting for the service, with other users when you intentionally use a community feature, during a legitimate business transition, to protect users or the service, or when required by law. Public/profile fields and community posts should be treated as visible to their intended audience.

6. Retention and deletion
Retention depends on the feature and legal/security need. Browser drafts may disappear when a session or local data is cleared. Lyric Pro may keep limited recent encrypted history—currently up to 10 songs or 24 hours—unless a feature states otherwise. Individual exit-survey ratings are pseudonymous, contain no written creative content, and are scheduled for deletion after 30 days; aggregate counts and averages may be retained to measure product improvement. Account, moderation, security, payment, tax, and dispute records may be kept longer where reasonably required. Request access, correction, or deletion at founder@indiebrotherhood.com; some records may remain where law, fraud prevention, security, or dispute handling requires them.

Signed-in members can submit access/export, correction, or deletion requests from My Profile under Your privacy requests. We record the account identifier, request type, receipt, timestamps, handling status, and the operator who responds. Replies are encrypted in our database. Open requests remain available for handling; closed requests and replies are removed from the active database by scheduled maintenance after 90 days, or replaced when a new request of the same type is opened. Retained backups may keep an older copy until their retention expires. Submitting a request does not itself delete an account, deliver an export, or cancel a subscription. We review ownership, shared records, retained-record exceptions, and subscription handling before confirming the outcome. You can also use the contact email above.

7. Security
We use access controls, verified authentication, encryption measures, rate limits, monitoring, and separation of private records. No internet service is perfectly secure. Keep your password private and report suspected compromise promptly.

8. Children and community safety
Accounts are not intended for children under 13. Members aged 13–17 require approval through a parent or guardian email and cannot use adult-restricted features. We do not knowingly permit under-13 accounts. Report suspected child endangerment or predatory conduct immediately to founder@indiebrotherhood.com.

9. Choices and changes
You can choose whether to invoke cloud AI, upload content, make a purchase, or join eligible community features. Material policy changes receive a new version and may require renewed acceptance. Questions: founder@indiebrotherhood.com.